CVE-2026-116067 in Paisa
Summary
by MITRE • 10/25/2026
Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in Paisa versions prior to 0.7.8 represents a critical path traversal flaw that compromises the integrity and confidentiality of data stored on the application server. This security defect is rooted in insufficient input validation within several core API handlers, specifically GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups. These endpoints are designed to manage file operations such as retrieving documents or managing backup archives, but they fail to properly sanitize user-supplied filenames before processing them against the underlying filesystem. By accepting arbitrary path sequences without adequate restriction, the application allows external actors to manipulate the intended directory structure, effectively bypassing access controls that should restrict operations to specific subdirectories like journals or sheets.
From a technical perspective, the exploitation mechanism relies on the injection of relative path traversal sequences, commonly known as dot-dot-slash (../) payloads, into file name parameters. When an unauthenticated attacker submits these crafted strings through the editor file and delete_backups endpoints, the application interprets them literally rather than sanitizing or resolving them against a safe base directory. This lack of normalization allows the request to escape the intended context and access parent directories on the server's filesystem. Consequently, this flaw enables two distinct malicious outcomes: unauthorized reading of arbitrary files that are readable by the user account running the Paisa service, and the deletion of backup files located outside the designated journal or sheets directories. The ability to read sensitive system files can lead to information disclosure, potentially exposing configuration details, credentials, or other proprietary data stored on the server.
The operational impact of this vulnerability is severe due to its unauthenticated nature and broad scope. Attackers do not need valid login credentials to exploit these endpoints, significantly lowering the barrier for entry in environments where Paisa is exposed to external networks. The ability to delete backups outside the expected directories poses a direct threat to business continuity and disaster recovery capabilities. If critical backup files are removed or corrupted, organizations may face data loss that cannot be easily recovered, leading to significant downtime and potential regulatory compliance issues depending on the sensitivity of the affected data. Furthermore, reading arbitrary server-readable files can serve as a stepping stone for further attacks, such as credential harvesting or lateral movement within the network infrastructure if sensitive configuration files are exposed.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements that can cause paths to traverse outside the intended directory structure. In terms of offensive security frameworks, this behavior corresponds to ATT&CK technique T1083: File and Directory Discovery, as it allows an attacker to enumerate and access files on a compromised system without authentication. To mitigate this risk, organizations running Paisa versions earlier than 0.7.8 must upgrade immediately to the patched version where input validation has been strengthened. If upgrading is not immediately feasible, administrators should implement network-level controls such as web application firewalls that can detect and block path traversal patterns in HTTP requests. Additionally, applying strict file system permissions to ensure the Paisa service runs with minimal privileges will limit the scope of files an attacker can read or delete even if they successfully exploit this vulnerability.